establishing-telemetry-baselines

Name: establishing-telemetry-baselines
Author: meltedinhex

18stars5forks

How to install establishing-telemetry-baselines?

meltedinhex/analyst-ai-pack/establishing-telemetry-baselines

$npx -y skills add meltedinhex/analyst-ai-pack --skill establishing-telemetry-baselines

Installs into the current project.

Summary

Establishes behavioral baselines from historical telemetry (process, network, or

Files · 1

View on GitHub

SKILL.md

1	# Establishing Telemetry Baselines
2
3	## When to Use
4
5	- You want to hunt for rare or first-seen behavior (uncommon process names, parent/child pairs,
6	destinations) by comparing current activity to a historical baseline.
7	- You are reducing noise by establishing what "normal" looks like before alerting on outliers.
8
9	Do not use a baseline built from a compromised period as "normal" — seed it from a known-good
10	window. This skill computes statistics from telemetry and executes nothing.
11
12	## Prerequisites
13
14	- Historical telemetry (CSV/JSON) with a categorical field to baseline (e.g., process name,
15	parent-child pair, destination host).
16
17	## Workflow
18
19	### Step 1: Build the baseline
20
21	```bash
22	python scripts/analyst.py baseline history.csv --field Image
23	```
24
25	Computes per-value counts, frequency (stacked-rank), and the set of values seen, saved as a JSON
26	baseline.
27
28	### Step 2: Score new activity against the baseline
29
30	```bash
31	python scripts/analyst.py compare new.csv --field Image --baseline baseline.json
32	```
33
34	Flags values not present in the baseline (first-seen) and values below a rarity threshold.
35
36	### Step 3: Triage outliers
37
38	Investigate first-seen and rare values; many will be benign-but-new — corroborate with context.
39
40	### Step 4: Maintain
41
42	Refresh the baseline on a rolling known-good window to avoid drift.
43
44	## Validation
45
46	- The baseline captures counts and the value set from the historical window.
47	- First-seen values in new data are correctly identified as absent from the baseline.
48	- Rarity thresholds are explicit and tunable.
49
50	## Pitfalls
51
52	- Baselining a compromised window, normalizing malicious activity.
53	- Too-short baseline windows making common items look rare.
54	- High-cardinality fields (full command lines) needing normalization before baselining.
55
56	## References
57
58	- See [`references/api-reference.md`](references/api-reference.md) for the baseliner.
59	- The ThreatHunting Project and ATT&CK hunting resources (linked in frontmatter).

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

establishing-telemetry-baselines

18stars5forks

View on GitHub

How to install establishing-telemetry-baselines?

meltedinhex/analyst-ai-pack/establishing-telemetry-baselines

$npx -y skills add meltedinhex/analyst-ai-pack --skill establishing-telemetry-baselines

Installs into the current project.

Summary

Establishes behavioral baselines from historical telemetry (process, network, or

Files · 1

View on GitHub

SKILL.md

1	# Establishing Telemetry Baselines
2
3	## When to Use
4
5	- You want to hunt for rare or first-seen behavior (uncommon process names, parent/child pairs,
6	destinations) by comparing current activity to a historical baseline.
7	- You are reducing noise by establishing what "normal" looks like before alerting on outliers.
8
9	Do not use a baseline built from a compromised period as "normal" — seed it from a known-good
10	window. This skill computes statistics from telemetry and executes nothing.
11
12	## Prerequisites
13
14	- Historical telemetry (CSV/JSON) with a categorical field to baseline (e.g., process name,
15	parent-child pair, destination host).
16
17	## Workflow
18
19	### Step 1: Build the baseline
20
21	```bash
22	python scripts/analyst.py baseline history.csv --field Image
23	```
24
25	Computes per-value counts, frequency (stacked-rank), and the set of values seen, saved as a JSON
26	baseline.
27
28	### Step 2: Score new activity against the baseline
29
30	```bash
31	python scripts/analyst.py compare new.csv --field Image --baseline baseline.json
32	```
33
34	Flags values not present in the baseline (first-seen) and values below a rarity threshold.
35
36	### Step 3: Triage outliers
37
38	Investigate first-seen and rare values; many will be benign-but-new — corroborate with context.
39
40	### Step 4: Maintain
41
42	Refresh the baseline on a rolling known-good window to avoid drift.
43
44	## Validation
45
46	- The baseline captures counts and the value set from the historical window.
47	- First-seen values in new data are correctly identified as absent from the baseline.
48	- Rarity thresholds are explicit and tunable.
49
50	## Pitfalls
51
52	- Baselining a compromised window, normalizing malicious activity.
53	- Too-short baseline windows making common items look rare.
54	- High-cardinality fields (full command lines) needing normalization before baselining.
55
56	## References
57
58	- See [`references/api-reference.md`](references/api-reference.md) for the baseliner.
59	- The ThreatHunting Project and ATT&CK hunting resources (linked in frontmatter).

People who liked this also viewed

6 picks

Type